2

On a particular Windows Vista PC, all programs signed with a particular certificate fail to launch from explorer, when it verifies the publisher. Only for a second or two, the hour glass is visible, and then nothing further happens (no error message).

  • When inspecting the properties of the program on the problematic PC, the certificate is shown correct and as valid.
  • The signed program launches fine on several other PCs (vista, w7, w8), verifying the publisher correctly.
  • The program launches normally when on the problematic PC if unsigned.
  • The program launches normally on the problematic PC if signed when Windows does not verify the publisher (e.g. when started from local disk). But it fails to launch when signed and started from a mapped drive.
  • Other signed programs launch fine on the particular PC, only programs signed with this particular certificate have the problem.

Process monitor shows that explorer.exe was checking the registery for disallowed certificates. But after checking, I found no part of the certificate chain in the untrusted (revoke) list. So that seems to be not the cause.

What could be the problem, or how could problems like this be diagnosed?

2 Answers 2

1

The problem in my case was that the signature algorithm of the particular certificate was sha256rsa. In KB2763674, it is documented that with certificate hashes of 256-bit or larger, a signed program might fail to launch on Windows Vista SP2 or Windows Server 2008 SP2. Installing the KB-patch and rebooting, solved the problem.

0

It could be blocked via Software Restriction Policies with Certificate rule.

  1. Open Local Security Settings.

  2. In the console tree, click Security Options.

    • Security Settings/Local Policies/Security Options
  3. In the details pane, double-click System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies.

  4. Do one of the following, and then click OK:

    • To enable certificate rules, click Enabled.

    • To disable certificate rules, click Disabled.

You could also try to disable signature verification in a .NET Framework 2.0 managed applications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .